1998-10-18 17:16:22 +02:00
|
|
|
/* Inner loops of cache daemon.
|
2004-06-28 06:42:05 +02:00
|
|
|
Copyright (C) 1998-2003, 2004 Free Software Foundation, Inc.
|
1998-01-31 09:39:55 +01:00
|
|
|
This file is part of the GNU C Library.
|
1998-10-18 17:16:22 +02:00
|
|
|
Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
|
1998-01-31 09:39:55 +01:00
|
|
|
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
2001-07-06 06:58:11 +02:00
|
|
|
modify it under the terms of the GNU Lesser General Public
|
|
|
|
License as published by the Free Software Foundation; either
|
|
|
|
version 2.1 of the License, or (at your option) any later version.
|
1998-01-31 09:39:55 +01:00
|
|
|
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
2001-07-06 06:58:11 +02:00
|
|
|
Lesser General Public License for more details.
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2001-07-06 06:58:11 +02:00
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
|
|
License along with the GNU C Library; if not, write to the Free
|
|
|
|
Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
|
|
|
|
02111-1307 USA. */
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
#include <assert.h>
|
2003-04-28 04:43:30 +02:00
|
|
|
#include <atomic.h>
|
1998-01-31 09:39:55 +01:00
|
|
|
#include <error.h>
|
1998-10-18 17:16:22 +02:00
|
|
|
#include <errno.h>
|
2004-08-25 19:24:52 +02:00
|
|
|
#include <fcntl.h>
|
2002-01-18 03:10:41 +01:00
|
|
|
#include <grp.h>
|
2004-08-26 20:35:05 +02:00
|
|
|
#include <libintl.h>
|
1998-01-31 09:39:55 +01:00
|
|
|
#include <pthread.h>
|
2002-01-18 03:10:41 +01:00
|
|
|
#include <pwd.h>
|
2004-06-28 06:42:05 +02:00
|
|
|
#include <resolv.h>
|
2002-01-18 03:10:41 +01:00
|
|
|
#include <stdio.h>
|
1998-01-31 09:39:55 +01:00
|
|
|
#include <stdlib.h>
|
|
|
|
#include <unistd.h>
|
1999-02-07 01:06:12 +01:00
|
|
|
#include <arpa/inet.h>
|
2004-08-26 20:35:05 +02:00
|
|
|
#include <sys/mman.h>
|
1998-10-18 17:16:22 +02:00
|
|
|
#include <sys/param.h>
|
1998-06-22 19:08:51 +02:00
|
|
|
#include <sys/poll.h>
|
1998-01-31 09:39:55 +01:00
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/un.h>
|
|
|
|
|
|
|
|
#include "nscd.h"
|
|
|
|
#include "dbg_log.h"
|
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
|
|
|
|
/* Number of bytes of data we initially reserve for each hash table bucket. */
|
|
|
|
#define DEFAULT_DATASIZE_PER_BUCKET 1024
|
|
|
|
|
|
|
|
|
2002-01-18 03:10:41 +01:00
|
|
|
/* Wrapper functions with error checking for standard functions. */
|
|
|
|
extern void *xmalloc (size_t n);
|
|
|
|
extern void *xcalloc (size_t n, size_t s);
|
|
|
|
extern void *xrealloc (void *o, size_t n);
|
|
|
|
|
|
|
|
/* Support to run nscd as an unprivileged user */
|
|
|
|
const char *server_user;
|
|
|
|
static uid_t server_uid;
|
|
|
|
static gid_t server_gid;
|
2003-05-04 09:00:44 +02:00
|
|
|
const char *stat_user;
|
|
|
|
uid_t stat_uid;
|
2002-01-18 03:10:41 +01:00
|
|
|
static gid_t *server_groups;
|
|
|
|
#ifndef NGROUPS
|
|
|
|
# define NGROUPS 32
|
|
|
|
#endif
|
2004-08-26 20:35:05 +02:00
|
|
|
static int server_ngroups;
|
2002-01-18 03:10:41 +01:00
|
|
|
|
|
|
|
static void begin_drop_privileges (void);
|
|
|
|
static void finish_drop_privileges (void);
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Map request type to a string. */
|
|
|
|
const char *serv2str[LASTREQ] =
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
[GETPWBYNAME] = "GETPWBYNAME",
|
|
|
|
[GETPWBYUID] = "GETPWBYUID",
|
|
|
|
[GETGRBYNAME] = "GETGRBYNAME",
|
|
|
|
[GETGRBYGID] = "GETGRBYGID",
|
|
|
|
[GETHOSTBYNAME] = "GETHOSTBYNAME",
|
|
|
|
[GETHOSTBYNAMEv6] = "GETHOSTBYNAMEv6",
|
|
|
|
[GETHOSTBYADDR] = "GETHOSTBYADDR",
|
|
|
|
[GETHOSTBYADDRv6] = "GETHOSTBYADDRv6",
|
|
|
|
[SHUTDOWN] = "SHUTDOWN",
|
1999-09-27 02:22:04 +02:00
|
|
|
[GETSTAT] = "GETSTAT",
|
2004-09-08 17:46:42 +02:00
|
|
|
[INVALIDATE] = "INVALIDATE",
|
|
|
|
[GETFDPW] = "GETFDPW",
|
|
|
|
[GETFDGR] = "GETFDGR",
|
|
|
|
[GETFDHST] = "GETFDHST"
|
1998-10-18 17:16:22 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
/* The control data structures for the services. */
|
2004-08-26 20:35:05 +02:00
|
|
|
struct database_dyn dbs[lastdb] =
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
|
|
|
[pwddb] = {
|
2002-12-16 00:23:24 +01:00
|
|
|
.lock = PTHREAD_RWLOCK_WRITER_NONRECURSIVE_INITIALIZER_NP,
|
|
|
|
.enabled = 0,
|
|
|
|
.check_file = 1,
|
2004-08-26 20:35:05 +02:00
|
|
|
.persistent = 0,
|
2004-09-08 17:46:42 +02:00
|
|
|
.shared = 0,
|
2002-12-16 00:23:24 +01:00
|
|
|
.filename = "/etc/passwd",
|
2004-08-26 20:35:05 +02:00
|
|
|
.db_filename = _PATH_NSCD_PASSWD_DB,
|
2002-12-16 00:23:24 +01:00
|
|
|
.disabled_iov = &pwd_iov_disabled,
|
|
|
|
.postimeout = 3600,
|
2004-08-26 20:35:05 +02:00
|
|
|
.negtimeout = 20,
|
|
|
|
.wr_fd = -1,
|
|
|
|
.ro_fd = -1,
|
|
|
|
.mmap_used = false
|
1998-10-18 17:16:22 +02:00
|
|
|
},
|
|
|
|
[grpdb] = {
|
2002-12-16 00:23:24 +01:00
|
|
|
.lock = PTHREAD_RWLOCK_WRITER_NONRECURSIVE_INITIALIZER_NP,
|
|
|
|
.enabled = 0,
|
|
|
|
.check_file = 1,
|
2004-08-26 20:35:05 +02:00
|
|
|
.persistent = 0,
|
2004-09-08 17:46:42 +02:00
|
|
|
.shared = 0,
|
2002-12-16 00:23:24 +01:00
|
|
|
.filename = "/etc/group",
|
2004-08-26 20:35:05 +02:00
|
|
|
.db_filename = _PATH_NSCD_GROUP_DB,
|
2002-12-16 00:23:24 +01:00
|
|
|
.disabled_iov = &grp_iov_disabled,
|
|
|
|
.postimeout = 3600,
|
2004-08-26 20:35:05 +02:00
|
|
|
.negtimeout = 60,
|
|
|
|
.wr_fd = -1,
|
|
|
|
.ro_fd = -1,
|
|
|
|
.mmap_used = false
|
1998-10-18 17:16:22 +02:00
|
|
|
},
|
|
|
|
[hstdb] = {
|
2002-12-16 00:23:24 +01:00
|
|
|
.lock = PTHREAD_RWLOCK_WRITER_NONRECURSIVE_INITIALIZER_NP,
|
|
|
|
.enabled = 0,
|
|
|
|
.check_file = 1,
|
2004-08-26 20:35:05 +02:00
|
|
|
.persistent = 0,
|
2004-09-08 17:46:42 +02:00
|
|
|
.shared = 0,
|
2002-12-16 00:23:24 +01:00
|
|
|
.filename = "/etc/hosts",
|
2004-08-26 20:35:05 +02:00
|
|
|
.db_filename = _PATH_NSCD_HOSTS_DB,
|
2002-12-16 00:23:24 +01:00
|
|
|
.disabled_iov = &hst_iov_disabled,
|
|
|
|
.postimeout = 3600,
|
2004-08-26 20:35:05 +02:00
|
|
|
.negtimeout = 20,
|
|
|
|
.wr_fd = -1,
|
|
|
|
.ro_fd = -1,
|
|
|
|
.mmap_used = false
|
1998-10-18 17:16:22 +02:00
|
|
|
}
|
|
|
|
};
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
|
|
|
|
/* Mapping of request type to database. */
|
2004-09-08 17:46:42 +02:00
|
|
|
static struct database_dyn *const serv2db[LASTREQ] =
|
2004-08-26 20:35:05 +02:00
|
|
|
{
|
|
|
|
[GETPWBYNAME] = &dbs[pwddb],
|
|
|
|
[GETPWBYUID] = &dbs[pwddb],
|
|
|
|
[GETGRBYNAME] = &dbs[grpdb],
|
|
|
|
[GETGRBYGID] = &dbs[grpdb],
|
|
|
|
[GETHOSTBYNAME] = &dbs[hstdb],
|
|
|
|
[GETHOSTBYNAMEv6] = &dbs[hstdb],
|
|
|
|
[GETHOSTBYADDR] = &dbs[hstdb],
|
2004-09-08 17:46:42 +02:00
|
|
|
[GETHOSTBYADDRv6] = &dbs[hstdb],
|
|
|
|
[GETFDPW] = &dbs[pwddb],
|
|
|
|
[GETFDGR] = &dbs[grpdb],
|
|
|
|
[GETFDHST] = &dbs[hstdb],
|
2004-08-26 20:35:05 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
|
1998-10-19 11:28:26 +02:00
|
|
|
/* Number of seconds between two cache pruning runs. */
|
|
|
|
#define CACHE_PRUNE_INTERVAL 15
|
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Number of threads to use. */
|
|
|
|
int nthreads = -1;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Socket for incoming connections. */
|
|
|
|
static int sock;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* Number of times clients had to wait. */
|
|
|
|
unsigned long int client_queued;
|
|
|
|
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Initialize database information structures. */
|
|
|
|
void
|
2003-05-04 09:00:44 +02:00
|
|
|
nscd_init (void)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
struct sockaddr_un sock_addr;
|
|
|
|
size_t cnt;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2002-01-18 03:10:41 +01:00
|
|
|
/* Secure mode and unprivileged mode are incompatible */
|
|
|
|
if (server_user != NULL && secure_in_use)
|
|
|
|
{
|
|
|
|
dbg_log (_("Cannot run nscd in secure mode as unprivileged user"));
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Look up unprivileged uid/gid/groups before we start listening on the
|
|
|
|
socket */
|
|
|
|
if (server_user != NULL)
|
|
|
|
begin_drop_privileges ();
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
if (nthreads == -1)
|
|
|
|
/* No configuration for this value, assume a default. */
|
|
|
|
nthreads = 2 * lastdb;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
for (cnt = 0; cnt < lastdb; ++cnt)
|
|
|
|
if (dbs[cnt].enabled)
|
1998-06-27 19:16:24 +02:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
pthread_rwlock_init (&dbs[cnt].lock, NULL);
|
2004-08-26 20:35:05 +02:00
|
|
|
pthread_mutex_init (&dbs[cnt].memlock, NULL);
|
1998-07-24 23:32:39 +02:00
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
if (dbs[cnt].persistent)
|
2003-01-16 08:54:50 +01:00
|
|
|
{
|
2004-08-26 20:35:05 +02:00
|
|
|
/* Try to open the appropriate file on disk. */
|
|
|
|
int fd = open (dbs[cnt].db_filename, O_RDWR);
|
|
|
|
if (fd != -1)
|
|
|
|
{
|
|
|
|
struct stat64 st;
|
|
|
|
void *mem;
|
|
|
|
size_t total;
|
|
|
|
struct database_pers_head head;
|
|
|
|
ssize_t n = TEMP_FAILURE_RETRY (read (fd, &head,
|
|
|
|
sizeof (head)));
|
|
|
|
if (n != sizeof (head) || fstat64 (fd, &st) != 0)
|
|
|
|
{
|
|
|
|
fail_db:
|
|
|
|
dbg_log (_("invalid persistent database file \"%s\": %s"),
|
|
|
|
dbs[cnt].db_filename, strerror (errno));
|
|
|
|
dbs[cnt].persistent = 0;
|
|
|
|
}
|
|
|
|
else if (head.module == 0 && head.data_size == 0)
|
|
|
|
{
|
|
|
|
/* The file has been created, but the head has not been
|
|
|
|
initialized yet. Remove the old file. */
|
|
|
|
unlink (dbs[cnt].db_filename);
|
|
|
|
}
|
|
|
|
else if (head.header_size != (int) sizeof (head))
|
|
|
|
{
|
|
|
|
dbg_log (_("invalid persistent database file \"%s\": %s"),
|
|
|
|
dbs[cnt].db_filename,
|
|
|
|
_("header size does not match"));
|
|
|
|
dbs[cnt].persistent = 0;
|
|
|
|
}
|
|
|
|
else if ((total = (sizeof (head)
|
2004-09-08 17:46:42 +02:00
|
|
|
+ roundup (head.module * sizeof (ref_t),
|
2004-08-26 20:35:05 +02:00
|
|
|
ALIGN)
|
|
|
|
+ head.data_size))
|
2004-09-08 17:46:42 +02:00
|
|
|
> st.st_size)
|
2004-08-26 20:35:05 +02:00
|
|
|
{
|
|
|
|
dbg_log (_("invalid persistent database file \"%s\": %s"),
|
|
|
|
dbs[cnt].db_filename,
|
|
|
|
_("file size does not match"));
|
|
|
|
dbs[cnt].persistent = 0;
|
|
|
|
}
|
|
|
|
else if ((mem = mmap (NULL, total, PROT_READ | PROT_WRITE,
|
|
|
|
MAP_SHARED, fd, 0)) == MAP_FAILED)
|
|
|
|
goto fail_db;
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Success. We have the database. */
|
|
|
|
dbs[cnt].head = mem;
|
|
|
|
dbs[cnt].memsize = total;
|
|
|
|
dbs[cnt].data = (char *)
|
|
|
|
&dbs[cnt].head->array[roundup (dbs[cnt].head->module,
|
|
|
|
ALIGN / sizeof (ref_t))];
|
|
|
|
dbs[cnt].mmap_used = true;
|
|
|
|
|
|
|
|
if (dbs[cnt].suggested_module > head.module)
|
|
|
|
dbg_log (_("suggested size of table for database %s larger than the persistent database's table"),
|
|
|
|
dbnames[cnt]);
|
|
|
|
|
|
|
|
dbs[cnt].wr_fd = fd;
|
2004-09-08 17:46:42 +02:00
|
|
|
dbs[cnt].ro_fd = open (dbs[cnt].db_filename, O_RDONLY);
|
2004-08-26 20:35:05 +02:00
|
|
|
fd = -1;
|
|
|
|
/* We also need a read-only descriptor. */
|
|
|
|
dbs[cnt].ro_fd = open (dbs[cnt].db_filename, O_RDONLY);
|
|
|
|
if (dbs[cnt].ro_fd == -1)
|
|
|
|
dbg_log (_("\
|
|
|
|
cannot create read-only descriptor for \"%s\"; no mmap"),
|
|
|
|
dbs[cnt].db_filename);
|
|
|
|
|
|
|
|
// XXX Shall we test whether the descriptors actually
|
|
|
|
// XXX point to the same file?
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Close the file descriptors in case something went
|
|
|
|
wrong in which case the variable have not been
|
|
|
|
assigned -1. */
|
|
|
|
if (fd != -1)
|
|
|
|
close (fd);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (dbs[cnt].head == NULL)
|
|
|
|
{
|
|
|
|
/* No database loaded. Allocate the data structure,
|
|
|
|
possibly on disk. */
|
|
|
|
struct database_pers_head head;
|
|
|
|
size_t total = (sizeof (head)
|
|
|
|
+ roundup (dbs[cnt].suggested_module
|
|
|
|
* sizeof (ref_t), ALIGN)
|
|
|
|
+ (dbs[cnt].suggested_module
|
|
|
|
* DEFAULT_DATASIZE_PER_BUCKET));
|
|
|
|
|
|
|
|
/* Try to create the database. If we do not need a
|
|
|
|
persistent database create a temporary file. */
|
|
|
|
int fd;
|
|
|
|
int ro_fd = -1;
|
|
|
|
if (dbs[cnt].persistent)
|
|
|
|
{
|
|
|
|
fd = open (dbs[cnt].db_filename,
|
|
|
|
O_RDWR | O_CREAT | O_EXCL | O_TRUNC,
|
|
|
|
S_IRUSR | S_IWUSR);
|
|
|
|
if (fd != -1)
|
|
|
|
ro_fd = open (dbs[cnt].db_filename, O_RDONLY);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
size_t slen = strlen (dbs[cnt].db_filename);
|
|
|
|
char fname[slen + 8];
|
|
|
|
strcpy (mempcpy (fname, dbs[cnt].db_filename, slen),
|
|
|
|
".XXXXXX");
|
|
|
|
fd = mkstemp (fname);
|
|
|
|
|
|
|
|
/* We do not need the file name anymore after we
|
|
|
|
opened another file descriptor in read-only mode. */
|
|
|
|
if (fd != -1)
|
|
|
|
{
|
|
|
|
ro_fd = open (fname, O_RDONLY);
|
|
|
|
|
|
|
|
unlink (fname);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (fd == -1)
|
|
|
|
{
|
|
|
|
if (errno == EEXIST)
|
|
|
|
{
|
|
|
|
dbg_log (_("database for %s corrupted or simultaneously used; remove %s manually if necessary and restart"),
|
|
|
|
dbnames[cnt], dbs[cnt].db_filename);
|
|
|
|
// XXX Correct way to terminate?
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (dbs[cnt].persistent)
|
|
|
|
dbg_log (_("cannot create %s; no persistent database used"),
|
|
|
|
dbs[cnt].db_filename);
|
|
|
|
else
|
|
|
|
dbg_log (_("cannot create %s; no sharing possible"),
|
|
|
|
dbs[cnt].db_filename);
|
|
|
|
|
|
|
|
dbs[cnt].persistent = 0;
|
|
|
|
// XXX remember: no mmap
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Tell the user if we could not create the read-only
|
|
|
|
descriptor. */
|
|
|
|
if (ro_fd == -1)
|
|
|
|
dbg_log (_("\
|
|
|
|
cannot create read-only descriptor for \"%s\"; no mmap"),
|
|
|
|
dbs[cnt].db_filename);
|
|
|
|
|
|
|
|
/* Before we create the header, initialiye the hash
|
|
|
|
table. So that if we get interrupted if writing
|
|
|
|
the header we can recognize a partially initialized
|
|
|
|
database. */
|
|
|
|
size_t ps = sysconf (_SC_PAGESIZE);
|
|
|
|
char tmpbuf[ps];
|
|
|
|
assert (~ENDREF == 0);
|
|
|
|
memset (tmpbuf, '\xff', ps);
|
|
|
|
|
|
|
|
size_t remaining = dbs[cnt].suggested_module * sizeof (ref_t);
|
|
|
|
off_t offset = sizeof (head);
|
|
|
|
|
|
|
|
size_t towrite;
|
|
|
|
if (offset % ps != 0)
|
|
|
|
{
|
|
|
|
towrite = MIN (remaining, ps - (offset % ps));
|
|
|
|
pwrite (fd, tmpbuf, towrite, offset);
|
|
|
|
offset += towrite;
|
|
|
|
remaining -= towrite;
|
|
|
|
}
|
|
|
|
|
|
|
|
while (remaining > ps)
|
|
|
|
{
|
|
|
|
pwrite (fd, tmpbuf, ps, offset);
|
|
|
|
offset += ps;
|
|
|
|
remaining -= ps;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (remaining > 0)
|
|
|
|
pwrite (fd, tmpbuf, remaining, offset);
|
|
|
|
|
|
|
|
/* Create the header of the file. */
|
|
|
|
struct database_pers_head head =
|
|
|
|
{
|
|
|
|
.version = DB_VERSION,
|
|
|
|
.header_size = sizeof (head),
|
|
|
|
.module = dbs[cnt].suggested_module,
|
|
|
|
.data_size = (dbs[cnt].suggested_module
|
|
|
|
* DEFAULT_DATASIZE_PER_BUCKET),
|
|
|
|
.first_free = 0
|
|
|
|
};
|
|
|
|
void *mem;
|
|
|
|
|
|
|
|
if ((TEMP_FAILURE_RETRY (write (fd, &head, sizeof (head)))
|
|
|
|
!= sizeof (head))
|
|
|
|
|| ftruncate (fd, total) != 0
|
|
|
|
|| (mem = mmap (NULL, total, PROT_READ | PROT_WRITE,
|
|
|
|
MAP_SHARED, fd, 0)) == MAP_FAILED)
|
|
|
|
{
|
|
|
|
unlink (dbs[cnt].db_filename);
|
|
|
|
dbg_log (_("cannot write to database file %s: %s"),
|
|
|
|
dbs[cnt].db_filename, strerror (errno));
|
|
|
|
dbs[cnt].persistent = 0;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Success. */
|
|
|
|
dbs[cnt].head = mem;
|
|
|
|
dbs[cnt].data = (char *)
|
|
|
|
&dbs[cnt].head->array[roundup (dbs[cnt].head->module,
|
|
|
|
ALIGN / sizeof (ref_t))];
|
|
|
|
dbs[cnt].memsize = total;
|
|
|
|
dbs[cnt].mmap_used = true;
|
|
|
|
|
|
|
|
/* Remember the descriptors. */
|
|
|
|
dbs[cnt].wr_fd = fd;
|
|
|
|
dbs[cnt].ro_fd = ro_fd;
|
|
|
|
fd = -1;
|
|
|
|
ro_fd = -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (fd != -1)
|
|
|
|
close (fd);
|
|
|
|
if (ro_fd != -1)
|
|
|
|
close (ro_fd);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (dbs[cnt].head == NULL)
|
|
|
|
{
|
|
|
|
/* We do not use the persistent database. Just
|
|
|
|
create an in-memory data structure. */
|
|
|
|
assert (! dbs[cnt].persistent);
|
|
|
|
|
|
|
|
dbs[cnt].head = xmalloc (sizeof (struct database_pers_head)
|
|
|
|
+ (dbs[cnt].suggested_module
|
|
|
|
* sizeof (ref_t)));
|
|
|
|
memset (dbs[cnt].head, '\0', sizeof (dbs[cnt].head));
|
|
|
|
assert (~ENDREF == 0);
|
|
|
|
memset (dbs[cnt].head->array, '\xff',
|
|
|
|
dbs[cnt].suggested_module * sizeof (ref_t));
|
|
|
|
dbs[cnt].head->module = dbs[cnt].suggested_module;
|
|
|
|
dbs[cnt].head->data_size = (DEFAULT_DATASIZE_PER_BUCKET
|
|
|
|
* dbs[cnt].head->module);
|
|
|
|
dbs[cnt].data = xmalloc (dbs[cnt].head->data_size);
|
|
|
|
dbs[cnt].head->first_free = 0;
|
2004-09-08 17:46:42 +02:00
|
|
|
|
|
|
|
dbs[cnt].shared = 0;
|
|
|
|
assert (dbs[cnt].ro_fd == -1);
|
2003-01-16 08:54:50 +01:00
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
if (dbs[cnt].check_file)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
/* We need the modification date of the file. */
|
|
|
|
struct stat st;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
if (stat (dbs[cnt].filename, &st) < 0)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
/* We cannot stat() the file, disable file checking. */
|
|
|
|
dbg_log (_("cannot stat() file `%s': %s"),
|
2003-01-16 08:54:50 +01:00
|
|
|
dbs[cnt].filename, strerror (errno));
|
1998-10-18 17:16:22 +02:00
|
|
|
dbs[cnt].check_file = 0;
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
|
|
|
else
|
1998-10-18 17:16:22 +02:00
|
|
|
dbs[cnt].file_mtime = st.st_mtime;
|
|
|
|
}
|
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
|
|
|
/* Create the socket. */
|
1998-10-18 17:16:22 +02:00
|
|
|
sock = socket (AF_UNIX, SOCK_STREAM, 0);
|
|
|
|
if (sock < 0)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
dbg_log (_("cannot open socket: %s"), strerror (errno));
|
1998-01-31 09:39:55 +01:00
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
/* Bind a name to the socket. */
|
|
|
|
sock_addr.sun_family = AF_UNIX;
|
|
|
|
strcpy (sock_addr.sun_path, _PATH_NSCDSOCKET);
|
1998-10-18 17:16:22 +02:00
|
|
|
if (bind (sock, (struct sockaddr *) &sock_addr, sizeof (sock_addr)) < 0)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
|
|
|
dbg_log ("%s: %s", _PATH_NSCDSOCKET, strerror (errno));
|
|
|
|
exit (1);
|
|
|
|
}
|
1998-10-18 17:16:22 +02:00
|
|
|
|
2004-08-25 19:24:52 +02:00
|
|
|
/* We don't wait for data otherwise races between threads can get
|
|
|
|
them stuck on accept. */
|
|
|
|
int fl = fcntl (sock, F_GETFL);
|
|
|
|
if (fl != -1)
|
|
|
|
fcntl (sock, F_SETFL, fl | O_NONBLOCK);
|
|
|
|
|
1998-01-31 09:39:55 +01:00
|
|
|
/* Set permissions for the socket. */
|
2004-08-26 20:35:05 +02:00
|
|
|
chmod (_PATH_NSCDSOCKET, DEFFILEMODE);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
|
|
|
/* Set the socket up to accept connections. */
|
1998-10-18 17:16:22 +02:00
|
|
|
if (listen (sock, SOMAXCONN) < 0)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
dbg_log (_("cannot enable socket to accept connections: %s"),
|
|
|
|
strerror (errno));
|
1998-01-31 09:39:55 +01:00
|
|
|
exit (1);
|
|
|
|
}
|
2002-01-18 03:10:41 +01:00
|
|
|
|
|
|
|
/* Change to unprivileged uid/gid/groups if specifed in config file */
|
|
|
|
if (server_user != NULL)
|
|
|
|
finish_drop_privileges ();
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
|
|
|
|
/* Close the connections. */
|
1998-01-31 09:39:55 +01:00
|
|
|
void
|
1998-10-18 17:16:22 +02:00
|
|
|
close_sockets (void)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
close (sock);
|
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2003-05-04 09:00:44 +02:00
|
|
|
|
1999-09-27 02:22:04 +02:00
|
|
|
static void
|
1999-09-27 09:02:38 +02:00
|
|
|
invalidate_cache (char *key)
|
1999-09-27 02:22:04 +02:00
|
|
|
{
|
|
|
|
dbtype number;
|
|
|
|
|
|
|
|
if (strcmp (key, "passwd") == 0)
|
|
|
|
number = pwddb;
|
|
|
|
else if (strcmp (key, "group") == 0)
|
|
|
|
number = grpdb;
|
2001-07-17 04:38:34 +02:00
|
|
|
else if (__builtin_expect (strcmp (key, "hosts"), 0) == 0)
|
2004-06-28 06:42:05 +02:00
|
|
|
{
|
|
|
|
number = hstdb;
|
|
|
|
|
|
|
|
/* Re-initialize the resolver. resolv.conf might have changed. */
|
|
|
|
res_init ();
|
|
|
|
}
|
2001-07-17 04:38:34 +02:00
|
|
|
else
|
|
|
|
return;
|
1999-09-27 02:22:04 +02:00
|
|
|
|
2000-10-23 19:11:35 +02:00
|
|
|
if (dbs[number].enabled)
|
|
|
|
prune_cache (&dbs[number], LONG_MAX);
|
1999-09-27 02:22:04 +02:00
|
|
|
}
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
|
2004-09-08 17:46:42 +02:00
|
|
|
#ifdef SCM_RIGHTS
|
|
|
|
static void
|
|
|
|
send_ro_fd (struct database_dyn *db, char *key, int fd)
|
|
|
|
{
|
|
|
|
/* If we do not have an read-only file descriptor do nothing. */
|
|
|
|
if (db->ro_fd == -1)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* We need to send some data along with the descriptor. */
|
|
|
|
struct iovec iov[1];
|
|
|
|
iov[0].iov_base = key;
|
|
|
|
iov[0].iov_len = strlen (key) + 1;
|
|
|
|
|
|
|
|
/* Prepare the control message to transfer the descriptor. */
|
|
|
|
char buf[CMSG_SPACE (sizeof (int))];
|
|
|
|
struct msghdr msg = { .msg_iov = iov, .msg_iovlen = 1,
|
|
|
|
.msg_control = buf, .msg_controllen = sizeof (buf) };
|
|
|
|
struct cmsghdr *cmsg = CMSG_FIRSTHDR (&msg);
|
|
|
|
|
|
|
|
cmsg->cmsg_level = SOL_SOCKET;
|
|
|
|
cmsg->cmsg_type = SCM_RIGHTS;
|
|
|
|
cmsg->cmsg_len = CMSG_LEN (sizeof (int));
|
|
|
|
|
|
|
|
*(int *) CMSG_DATA (cmsg) = db->ro_fd;
|
|
|
|
|
|
|
|
msg.msg_controllen = cmsg->cmsg_len;
|
|
|
|
|
|
|
|
/* Send the control message. We repeat when we are interrupted but
|
|
|
|
everything else is ignored. */
|
|
|
|
(void) TEMP_FAILURE_RETRY (sendmsg (fd, &msg, 0));
|
|
|
|
|
|
|
|
if (__builtin_expect (debug_level > 0, 0))
|
|
|
|
dbg_log (_("provide access to FD %d, for %s"), db->ro_fd, key);
|
|
|
|
}
|
|
|
|
#endif /* SCM_RIGHTS */
|
|
|
|
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Handle new request. */
|
|
|
|
static void
|
1999-06-11 22:58:21 +02:00
|
|
|
handle_request (int fd, request_header *req, void *key, uid_t uid)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
2001-07-17 04:38:34 +02:00
|
|
|
if (__builtin_expect (req->version, NSCD_VERSION) != NSCD_VERSION)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2001-07-17 03:37:42 +02:00
|
|
|
if (debug_level > 0)
|
|
|
|
dbg_log (_("\
|
1998-10-18 17:16:22 +02:00
|
|
|
cannot handle old request version %d; current version is %d"),
|
2001-07-17 03:37:42 +02:00
|
|
|
req->version, NSCD_VERSION);
|
1998-01-31 09:39:55 +01:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
struct database_dyn *db = serv2db[req->type];
|
|
|
|
|
2001-07-17 04:38:34 +02:00
|
|
|
if (__builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME
|
|
|
|
&& __builtin_expect (req->type, LASTDBREQ) <= LASTDBREQ)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2001-07-17 04:38:34 +02:00
|
|
|
if (__builtin_expect (debug_level, 0) > 0)
|
1999-02-07 01:06:12 +01:00
|
|
|
{
|
|
|
|
if (req->type == GETHOSTBYADDR || req->type == GETHOSTBYADDRv6)
|
|
|
|
{
|
|
|
|
char buf[INET6_ADDRSTRLEN];
|
|
|
|
|
|
|
|
dbg_log ("\t%s (%s)", serv2str[req->type],
|
|
|
|
inet_ntop (req->type == GETHOSTBYADDR
|
|
|
|
? AF_INET : AF_INET6,
|
|
|
|
key, buf, sizeof (buf)));
|
|
|
|
}
|
|
|
|
else
|
2004-08-26 20:35:05 +02:00
|
|
|
dbg_log ("\t%s (%s)", serv2str[req->type], (char *) key);
|
1999-02-07 01:06:12 +01:00
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Is this service enabled? */
|
|
|
|
if (!db->enabled)
|
|
|
|
{
|
1998-10-19 17:22:14 +02:00
|
|
|
/* No, sent the prepared record. */
|
1998-10-18 17:16:22 +02:00
|
|
|
if (TEMP_FAILURE_RETRY (write (fd, db->disabled_iov->iov_base,
|
|
|
|
db->disabled_iov->iov_len))
|
2003-04-22 21:52:59 +02:00
|
|
|
!= (ssize_t) db->disabled_iov->iov_len
|
2001-07-17 04:38:34 +02:00
|
|
|
&& __builtin_expect (debug_level, 0) > 0)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
|
|
|
/* We have problems sending the result. */
|
|
|
|
char buf[256];
|
|
|
|
dbg_log (_("cannot write result: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
return;
|
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* Be sure we can read the data. */
|
2003-04-26 06:15:50 +02:00
|
|
|
if (__builtin_expect (pthread_rwlock_tryrdlock (&db->lock) != 0, 0))
|
|
|
|
{
|
2004-08-26 20:35:05 +02:00
|
|
|
++db->head->rdlockdelayed;
|
2003-04-26 06:15:50 +02:00
|
|
|
pthread_rwlock_rdlock (&db->lock);
|
|
|
|
}
|
1998-10-18 17:16:22 +02:00
|
|
|
|
|
|
|
/* See whether we can handle it from the cache. */
|
2004-08-26 20:35:05 +02:00
|
|
|
struct datahead *cached;
|
|
|
|
cached = (struct datahead *) cache_search (req->type, key, req->key_len,
|
|
|
|
db, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
if (cached != NULL)
|
|
|
|
{
|
|
|
|
/* Hurray it's in the cache. */
|
2004-08-26 20:35:05 +02:00
|
|
|
if (TEMP_FAILURE_RETRY (write (fd, cached->data, cached->recsize))
|
|
|
|
!= cached->recsize
|
2001-07-17 04:38:34 +02:00
|
|
|
&& __builtin_expect (debug_level, 0) > 0)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
|
|
|
/* We have problems sending the result. */
|
|
|
|
char buf[256];
|
|
|
|
dbg_log (_("cannot write result: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
|
|
|
}
|
|
|
|
|
|
|
|
pthread_rwlock_unlock (&db->lock);
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
pthread_rwlock_unlock (&db->lock);
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
2001-07-17 04:38:34 +02:00
|
|
|
else if (__builtin_expect (debug_level, 0) > 0)
|
1999-09-27 02:22:04 +02:00
|
|
|
{
|
|
|
|
if (req->type == INVALIDATE)
|
2004-09-08 17:46:42 +02:00
|
|
|
dbg_log ("\t%s (%s)", serv2str[req->type], (char *) key);
|
2004-08-04 08:25:42 +02:00
|
|
|
else
|
2004-08-26 20:35:05 +02:00
|
|
|
dbg_log ("\t%s", serv2str[req->type]);
|
1999-09-27 02:22:04 +02:00
|
|
|
}
|
1998-10-18 17:16:22 +02:00
|
|
|
|
|
|
|
/* Handle the request. */
|
|
|
|
switch (req->type)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
1998-10-18 17:16:22 +02:00
|
|
|
case GETPWBYNAME:
|
2004-08-26 20:35:05 +02:00
|
|
|
addpwbyname (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETPWBYUID:
|
2004-08-26 20:35:05 +02:00
|
|
|
addpwbyuid (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETGRBYNAME:
|
2004-08-26 20:35:05 +02:00
|
|
|
addgrbyname (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETGRBYGID:
|
2004-08-26 20:35:05 +02:00
|
|
|
addgrbygid (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETHOSTBYNAME:
|
2004-08-26 20:35:05 +02:00
|
|
|
addhstbyname (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETHOSTBYNAMEv6:
|
2004-08-26 20:35:05 +02:00
|
|
|
addhstbynamev6 (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETHOSTBYADDR:
|
2004-08-26 20:35:05 +02:00
|
|
|
addhstbyaddr (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETHOSTBYADDRv6:
|
2004-08-26 20:35:05 +02:00
|
|
|
addhstbyaddrv6 (db, fd, req, key, uid);
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case GETSTAT:
|
|
|
|
case SHUTDOWN:
|
1999-09-27 02:22:04 +02:00
|
|
|
case INVALIDATE:
|
2003-05-04 09:00:44 +02:00
|
|
|
if (! secure_in_use)
|
1999-06-15 13:54:33 +02:00
|
|
|
{
|
2003-05-04 09:00:44 +02:00
|
|
|
/* Get the callers credentials. */
|
2000-01-08 11:13:33 +01:00
|
|
|
#ifdef SO_PEERCRED
|
2002-09-05 20:52:18 +02:00
|
|
|
struct ucred caller;
|
|
|
|
socklen_t optlen = sizeof (caller);
|
|
|
|
|
1999-06-11 22:58:21 +02:00
|
|
|
if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &caller, &optlen) < 0)
|
|
|
|
{
|
|
|
|
char buf[256];
|
|
|
|
|
|
|
|
dbg_log (_("error getting callers id: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
2003-05-04 09:00:44 +02:00
|
|
|
break;
|
1999-06-11 22:58:21 +02:00
|
|
|
}
|
2003-05-04 09:00:44 +02:00
|
|
|
|
|
|
|
uid = caller.uid;
|
|
|
|
#else
|
|
|
|
/* Some systems have no SO_PEERCRED implementation. They don't
|
|
|
|
care about security so we don't as well. */
|
|
|
|
uid = 0;
|
2000-01-08 11:13:33 +01:00
|
|
|
#endif
|
2003-05-04 09:00:44 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Accept shutdown, getstat and invalidate only from root. For
|
|
|
|
the stat call also allow the user specified in the config file. */
|
|
|
|
if (req->type == GETSTAT)
|
|
|
|
{
|
|
|
|
if (uid == 0 || uid == stat_uid)
|
|
|
|
send_stats (fd, dbs);
|
|
|
|
}
|
|
|
|
else if (uid == 0)
|
|
|
|
{
|
|
|
|
if (req->type == INVALIDATE)
|
|
|
|
invalidate_cache (key);
|
|
|
|
else
|
|
|
|
termination_handler (0);
|
1999-06-11 22:58:21 +02:00
|
|
|
}
|
1998-10-18 17:16:22 +02:00
|
|
|
break;
|
|
|
|
|
2004-09-08 17:46:42 +02:00
|
|
|
case GETFDPW:
|
|
|
|
case GETFDGR:
|
|
|
|
case GETFDHST:
|
|
|
|
#ifdef SCM_RIGHTS
|
|
|
|
send_ro_fd (serv2db[req->type], key, fd);
|
|
|
|
#endif
|
|
|
|
break;
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
default:
|
2000-02-18 18:25:16 +01:00
|
|
|
/* Ignore the command, it's nothing we know. */
|
|
|
|
break;
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
1998-10-18 17:16:22 +02:00
|
|
|
}
|
|
|
|
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* This is the main loop. It is replicated in different threads but the
|
|
|
|
`poll' call makes sure only one thread handles an incoming connection. */
|
|
|
|
static void *
|
|
|
|
__attribute__ ((__noreturn__))
|
|
|
|
nscd_run (void *p)
|
|
|
|
{
|
2000-03-22 01:36:57 +01:00
|
|
|
long int my_number = (long int) p;
|
1998-10-18 17:16:22 +02:00
|
|
|
struct pollfd conn;
|
|
|
|
int run_prune = my_number < lastdb && dbs[my_number].enabled;
|
2003-04-28 04:43:30 +02:00
|
|
|
time_t next_prune = run_prune ? time (NULL) + CACHE_PRUNE_INTERVAL : 0;
|
|
|
|
static unsigned long int nready;
|
1998-07-24 23:32:39 +02:00
|
|
|
|
2004-09-08 19:56:46 +02:00
|
|
|
if (my_number < lastdb)
|
|
|
|
setup_thread (&dbs[my_number]);
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
conn.fd = sock;
|
|
|
|
conn.events = POLLRDNORM;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
while (1)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2003-04-28 04:43:30 +02:00
|
|
|
int nr;
|
2004-08-25 19:24:52 +02:00
|
|
|
time_t now = 0;
|
2003-04-28 04:43:30 +02:00
|
|
|
|
|
|
|
/* One more thread available. */
|
|
|
|
atomic_increment (&nready);
|
|
|
|
|
|
|
|
no_conn:
|
2004-08-25 19:24:52 +02:00
|
|
|
do
|
|
|
|
{
|
|
|
|
int timeout = -1;
|
|
|
|
if (run_prune)
|
|
|
|
{
|
2004-09-08 17:46:42 +02:00
|
|
|
/* NB: we do not flush the timestamp update using msync since
|
|
|
|
this value doesnot matter on disk. */
|
|
|
|
dbs[my_number].head->timestamp = now = time (NULL);
|
2004-08-25 19:24:52 +02:00
|
|
|
timeout = now < next_prune ? 1000 * (next_prune - now) : 0;
|
|
|
|
}
|
2003-04-28 04:43:30 +02:00
|
|
|
|
2004-08-25 19:24:52 +02:00
|
|
|
nr = poll (&conn, 1, timeout);
|
2003-04-28 04:43:30 +02:00
|
|
|
|
2004-08-25 19:24:52 +02:00
|
|
|
if (nr == 0)
|
|
|
|
{
|
|
|
|
/* The `poll' call timed out. It's time to clean up the
|
|
|
|
cache. */
|
|
|
|
atomic_decrement (&nready);
|
|
|
|
assert (my_number < lastdb);
|
|
|
|
prune_cache (&dbs[my_number], time(NULL));
|
|
|
|
now = time (NULL);
|
|
|
|
next_prune = now + CACHE_PRUNE_INTERVAL;
|
2004-08-26 20:35:05 +02:00
|
|
|
|
2004-08-25 19:24:52 +02:00
|
|
|
goto try_get;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
while ((conn.revents & POLLRDNORM) == 0);
|
2003-04-28 04:43:30 +02:00
|
|
|
|
|
|
|
got_data:;
|
|
|
|
/* We have a new incoming connection. Accept the connection. */
|
|
|
|
int fd = TEMP_FAILURE_RETRY (accept (conn.fd, NULL, NULL));
|
|
|
|
request_header req;
|
|
|
|
char buf[256];
|
2003-05-04 09:00:44 +02:00
|
|
|
uid_t uid = -1;
|
2003-04-28 04:43:30 +02:00
|
|
|
#ifdef SO_PEERCRED
|
|
|
|
pid_t pid = 0;
|
|
|
|
#endif
|
1998-10-18 17:16:22 +02:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
if (__builtin_expect (fd, 0) < 0)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
2004-08-25 19:24:52 +02:00
|
|
|
if (errno != EAGAIN && errno != EWOULDBLOCK)
|
|
|
|
dbg_log (_("while accepting connection: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
2003-04-28 04:43:30 +02:00
|
|
|
goto no_conn;
|
1998-10-18 17:16:22 +02:00
|
|
|
}
|
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* This thread is busy. */
|
|
|
|
atomic_decrement (&nready);
|
|
|
|
|
|
|
|
/* Now read the request. */
|
|
|
|
if (__builtin_expect (TEMP_FAILURE_RETRY (read (fd, &req, sizeof (req)))
|
|
|
|
!= sizeof (req), 0))
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2003-04-28 04:43:30 +02:00
|
|
|
if (debug_level > 0)
|
|
|
|
dbg_log (_("short read while reading request: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
|
|
|
close (fd);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2004-09-03 05:39:45 +02:00
|
|
|
/* Check whether this is a valid request type. */
|
|
|
|
if (req.type < GETPWBYNAME || req.type >= LASTREQ)
|
|
|
|
goto close_and_out;
|
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* Some systems have no SO_PEERCRED implementation. They don't
|
|
|
|
care about security so we don't as well. */
|
2003-04-26 06:15:50 +02:00
|
|
|
#ifdef SO_PEERCRED
|
2003-04-28 04:43:30 +02:00
|
|
|
if (secure_in_use)
|
|
|
|
{
|
|
|
|
struct ucred caller;
|
|
|
|
socklen_t optlen = sizeof (caller);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &caller, &optlen) < 0)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2003-04-28 04:43:30 +02:00
|
|
|
dbg_log (_("error getting callers id: %s"),
|
1998-10-18 17:16:22 +02:00
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
2004-09-03 05:39:45 +02:00
|
|
|
goto close_and_out;
|
1998-10-18 17:16:22 +02:00
|
|
|
}
|
1998-07-24 23:32:39 +02:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
if (req.type < GETPWBYNAME || req.type > LASTDBREQ
|
2004-08-26 20:35:05 +02:00
|
|
|
|| serv2db[req.type]->secure)
|
2003-04-28 04:43:30 +02:00
|
|
|
uid = caller.uid;
|
2003-04-26 06:15:50 +02:00
|
|
|
|
2003-05-04 09:00:44 +02:00
|
|
|
pid = caller.pid;
|
2003-04-28 04:43:30 +02:00
|
|
|
}
|
|
|
|
else if (__builtin_expect (debug_level > 0, 0))
|
|
|
|
{
|
|
|
|
struct ucred caller;
|
|
|
|
socklen_t optlen = sizeof (caller);
|
2003-04-26 06:15:50 +02:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &caller, &optlen) == 0)
|
|
|
|
pid = caller.pid;
|
|
|
|
}
|
2000-01-08 11:13:33 +01:00
|
|
|
#endif
|
1999-06-11 22:58:21 +02:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* It should not be possible to crash the nscd with a silly
|
|
|
|
request (i.e., a terribly large key). We limit the size to 1kb. */
|
|
|
|
if (__builtin_expect (req.key_len, 1) < 0
|
|
|
|
|| __builtin_expect (req.key_len, 1) > 1024)
|
|
|
|
{
|
|
|
|
if (debug_level > 0)
|
|
|
|
dbg_log (_("key length in request too long: %d"), req.key_len);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Get the key. */
|
|
|
|
char keybuf[req.key_len];
|
|
|
|
|
|
|
|
if (__builtin_expect (TEMP_FAILURE_RETRY (read (fd, keybuf,
|
|
|
|
req.key_len))
|
|
|
|
!= req.key_len, 0))
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
2001-07-17 03:37:42 +02:00
|
|
|
if (debug_level > 0)
|
2003-04-28 04:43:30 +02:00
|
|
|
dbg_log (_("short read while reading request key: %s"),
|
|
|
|
strerror_r (errno, buf, sizeof (buf)));
|
1998-10-18 17:16:22 +02:00
|
|
|
close (fd);
|
|
|
|
continue;
|
|
|
|
}
|
2003-04-28 04:43:30 +02:00
|
|
|
|
|
|
|
if (__builtin_expect (debug_level, 0) > 0)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
2003-04-26 06:15:50 +02:00
|
|
|
#ifdef SO_PEERCRED
|
2003-04-28 04:43:30 +02:00
|
|
|
if (pid != 0)
|
|
|
|
dbg_log (_("\
|
2003-04-26 06:15:50 +02:00
|
|
|
handle_request: request received (Version = %d) from PID %ld"),
|
2003-04-28 04:43:30 +02:00
|
|
|
req.version, (long int) pid);
|
|
|
|
else
|
2003-04-26 06:15:50 +02:00
|
|
|
#endif
|
2003-04-28 04:43:30 +02:00
|
|
|
dbg_log (_("\
|
2003-04-26 06:15:50 +02:00
|
|
|
handle_request: request received (Version = %d)"), req.version);
|
2003-04-28 04:43:30 +02:00
|
|
|
}
|
2003-04-26 06:15:50 +02:00
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* Phew, we got all the data, now process it. */
|
|
|
|
handle_request (fd, &req, keybuf, uid);
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
1998-07-24 23:32:39 +02:00
|
|
|
|
2004-09-03 05:39:45 +02:00
|
|
|
close_and_out:
|
|
|
|
/* We are done. */
|
|
|
|
close (fd);
|
|
|
|
|
2003-04-28 04:43:30 +02:00
|
|
|
/* Just determine whether any data is present. We do this to
|
|
|
|
measure whether clients are queued up. */
|
|
|
|
try_get:
|
|
|
|
nr = poll (&conn, 1, 0);
|
|
|
|
if (nr != 0)
|
1998-10-18 17:16:22 +02:00
|
|
|
{
|
2003-04-28 04:43:30 +02:00
|
|
|
if (nready == 0)
|
|
|
|
++client_queued;
|
|
|
|
|
|
|
|
atomic_increment (&nready);
|
|
|
|
|
|
|
|
goto got_data;
|
1998-10-18 17:16:22 +02:00
|
|
|
}
|
1998-07-25 20:02:26 +02:00
|
|
|
}
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
|
|
|
|
/* Start all the threads we want. The initial process is thread no. 1. */
|
1998-01-31 09:39:55 +01:00
|
|
|
void
|
1998-10-18 17:16:22 +02:00
|
|
|
start_threads (void)
|
1998-01-31 09:39:55 +01:00
|
|
|
{
|
2000-01-19 01:10:36 +01:00
|
|
|
long int i;
|
1998-10-18 17:16:22 +02:00
|
|
|
pthread_attr_t attr;
|
|
|
|
pthread_t th;
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
pthread_attr_init (&attr);
|
|
|
|
pthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
/* We allow less than LASTDB threads only for debugging. */
|
|
|
|
if (debug_level == 0)
|
|
|
|
nthreads = MAX (nthreads, lastdb);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
for (i = 1; i < nthreads; ++i)
|
|
|
|
pthread_create (&th, &attr, nscd_run, (void *) i);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
pthread_attr_destroy (&attr);
|
1998-01-31 09:39:55 +01:00
|
|
|
|
1998-10-18 17:16:22 +02:00
|
|
|
nscd_run ((void *) 0);
|
1998-01-31 09:39:55 +01:00
|
|
|
}
|
2002-01-18 03:10:41 +01:00
|
|
|
|
|
|
|
|
|
|
|
/* Look up the uid, gid, and supplementary groups to run nscd as. When
|
|
|
|
this function is called, we are not listening on the nscd socket yet so
|
|
|
|
we can just use the ordinary lookup functions without causing a lockup */
|
|
|
|
static void
|
|
|
|
begin_drop_privileges (void)
|
|
|
|
{
|
2004-08-26 20:35:05 +02:00
|
|
|
struct passwd *pwd = getpwnam (server_user);
|
2002-01-18 03:10:41 +01:00
|
|
|
|
|
|
|
if (pwd == NULL)
|
|
|
|
{
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
error (EXIT_FAILURE, 0, _("Failed to run nscd as user '%s'"),
|
|
|
|
server_user);
|
|
|
|
}
|
|
|
|
|
|
|
|
server_uid = pwd->pw_uid;
|
|
|
|
server_gid = pwd->pw_gid;
|
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
if (getgrouplist (server_user, server_gid, NULL, &server_ngroups) == 0)
|
|
|
|
{
|
|
|
|
/* This really must never happen. */
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
error (EXIT_FAILURE, errno, _("initial getgrouplist failed"));
|
|
|
|
}
|
2002-01-18 03:10:41 +01:00
|
|
|
|
2004-08-26 20:35:05 +02:00
|
|
|
server_groups = (gid_t *) xmalloc (server_ngroups * sizeof (gid_t));
|
2002-01-18 03:10:41 +01:00
|
|
|
|
|
|
|
if (getgrouplist (server_user, server_gid, server_groups, &server_ngroups)
|
|
|
|
== -1)
|
|
|
|
{
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
error (EXIT_FAILURE, errno, _("getgrouplist failed"));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* Call setgroups(), setgid(), and setuid() to drop root privileges and
|
|
|
|
run nscd as the user specified in the configuration file. */
|
|
|
|
static void
|
|
|
|
finish_drop_privileges (void)
|
|
|
|
{
|
|
|
|
if (setgroups (server_ngroups, server_groups) == -1)
|
|
|
|
{
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
error (EXIT_FAILURE, errno, _("setgroups failed"));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (setgid (server_gid) == -1)
|
|
|
|
{
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
perror ("setgid");
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (setuid (server_uid) == -1)
|
|
|
|
{
|
|
|
|
dbg_log (_("Failed to run nscd as user '%s'"), server_user);
|
|
|
|
perror ("setuid");
|
|
|
|
exit (1);
|
|
|
|
}
|
|
|
|
}
|